verify command complaining when emailProtection key usage is set

[vteraz]

Hi there.

I've created a provisioner template that includes the following configuration:

....
"extKeyUsage": ["emailProtection"]
....

I managed to create a certificate using that template, but when I run verify command for that certificate I have an error:

vagrant@vagrant:/vagrant/work/step-ca/organization/demo$ STEPDEBUG=1 step certificate verify my_cert.crt --roots ~/.step/certs/root_ca.crt
x509: certificate specifies an incompatible key usage
failed to verify certificate
github.com/smallstep/cli/command/certificate.verifyAction
        /home/runner/work/cli/cli/command/certificate/verify.go:174
github.com/urfave/cli.HandleAction
        /home/runner/go/pkg/mod/github.com/urfave/[email protected]/app.go:524
github.com/urfave/cli.Command.Run
        /home/runner/go/pkg/mod/github.com/urfave/[email protected]/command.go:174
github.com/urfave/cli.(*App).RunAsSubcommand
        /home/runner/go/pkg/mod/github.com/urfave/[email protected]/app.go:407
github.com/urfave/cli.Command.startApp
        /home/runner/go/pkg/mod/github.com/urfave/[email protected]/command.go:373
github.com/urfave/cli.Command.Run
        /home/runner/go/pkg/mod/github.com/urfave/[email protected]/command.go:102
github.com/urfave/cli.(*App).Run
        /home/runner/go/pkg/mod/github.com/urfave/[email protected]/app.go:279
main.main
        /home/runner/work/cli/cli/cmd/step/main.go:97
runtime.main
        /opt/hostedtoolcache/go/1.15.8/x64/src/runtime/proc.go:204
runtime.goexit
        /opt/hostedtoolcache/go/1.15.8/x64/src/runtime/asm_amd64.s:1374

If I delete the line "extKeyUsage": ["emailProtection"] from template and regenerate cert - verify is successful.

Can somebody advise with that?

Side note:
When I run verify command using openssl - it works:

openssl verify -verbose -CAfile <(cat ~/.step/certs/intermediate_ca.crt) my_cert.crt

Thanks

[maraino]

Hi @vteraz, the problems is that with the current verification options, the command will only verify certificate with the serverAuth extended key usage. I've created an issue to fix this smallstep/cli#467

[maraino]

@vteraz I've pushed a change to https://github.com/smallstep/cli to allow the verification of any type of cert. At some point in the future we will add flags to specify the purpose of a certificate and be able to validate it properly.